SSPI Authentication Errors
| KB ID: | 4542 |
| Product: |
Veeam Backup & Replication | 12 | 12.1 | 12.2 | 12.3 | 12.3.1 | 12.3.2 | 13 | 13.1 Veeam ONE | 13 | 13.1 |
| Published: | 2024-01-26 |
| Last Modified: | 2026-04-07 |
Oops! Something went wrong.
Please, try again later.
Challenge
In Veeam Backup & Replication
When installing updates, restoring configuration, or directly interacting with the database (e.g., using pgAdmin), the following error occurs:
SSPI authentication failed for user
In Veeam ONE
When upgrading to Veeam ONE v13, the following error may occur:
28000: sspi authentication failed for user "postgres".
Cause
This error occurs when the account used to interact with the PostgreSQL instance is not authorized.
When PostgreSQL is deployed by the Veeam installer, the PostgreSQL database engine is configured to use SSPI Authentication, allowing authentication with Windows accounts. During the installer's configuration of the PostgreSQL instance, only two Windows accounts are automatically added for access:
- The Windows account that was used during the initial install.
- The NT AUTHORITY\SYSTEM account (The account used by the Veeam services.)
If the SSPI authentication error occurred during an upgrade of the product and PostgreSQL is already installed, the user account used to run the upgrade is likely not configured in PostgreSQL for access.
Note: In Veeam ONE version 13 and higher, if the service account is different than the account that ran the initial installer, that service account will be added to the pg_ident.conf configuration file as a third account having a access to the database.
Solution
Identify Which Windows Accounts Have Access to PostgreSQL
- Using a text editor, open the pg_ident.conf configuration file, found in:
C:\Program Files\PostgreSQL\##\data\
The ## value is relative to the PostgreSQL version installed. - At the bottom of the file, you will find at least two uncommented lines with a format similar to this example*:
veeam User@Domain postgres
*This is true if the PostgreSQL instance was created by the Veeam Backup & Replication or Veeam ONE installer. However, if the PGSQL Instance was user-created, the mapname and pg-username may differ.
- If the non-SYSTEM account is available to you, use that account to perform the action that initially failed with the SSPI error.
For example, in the example pg_ident.conf file above, the account DOMAIN\Backupsvc should be used.
If the non-SYSTEM account is no longer available, review the next section for information about adding a new authorized user to access the PostgreSQL instance.
If Veeam Backup & Replication or Veeam ONE was deployed using a local administrator account, and the hostname was changed after the software was installed, the entry for that local account within the pg_ident.conf file will be invalid.
Update the pg_ident.conf file with the new hostname for all local user accounts.
For example, if the hostname was changed from WIN-JQN7UPJGBHG to vbrsrvr after installation, and installation was performed with the local Administrator account:
Old Entry
veeam Administrator@WIN-JQN7UPJGBHG postgres
Updated Entry
veeam Administrator@vbrsrvr postgres
Adding a Windows Account to The Authorized Users List
If none of the non-SYSTEM accounts presently listed in the pg_ident.conf file are available to you, review the following steps to add your user account for access to the PostgreSQL instance.
Security Considerations
For day-to-day tasks involving Veeam Backup & Replication and Veeam ONE, a user does not need direct access to the PostgreSQL instance. Therefore, from a security standpoint, it may be best to only add accounts to the pg_ident.conf file when necessary. (Consider assigning a single account as the account that will be used for performing product updates or Configuration Restores for Veeam Backup & Replication.)
Part 1: Identify Which Account Was in Use When the SSPI Error Occurred
These steps assume the SSPI error has recently occurred and is still in the latest log file.
- Navigate to the PostgreSQL log folder.
The default PostgreSQL 15 path: C:\Program Files\PostgreSQL\15\data\log\
The default PostgreSQL 17 path: C:\Program Files\PostgreSQL\17\data\log - Sort the folder contents by last modified time, then open the latest log file.
- Scroll to the end of the log file and begin scrolling up. Look for entries like this:
LOG: no match in usermap "veeam" for user "postgres" authenticated as "pgadmin@VBR12" FATAL: SSPI authentication failed for user "postgres"
- Take note of the account indicated in the error.
(In the example above, the account pgadmin@VBR12 is listed at the very end of line 1.)
Part 2: Add the Windows account as it appears in the error to pg_ident.conf
- Using a text editor, open the pg_ident.conf configuration file, found in:
C:\Program Files\PostgreSQL\##\data\
The ## value is relative to the PostgreSQL version installed. - Add a new line at the bottom of the file in the following format:
Replace pgadmin@VBR12 with the account you identified in your logs on Step 4.
veeam pgadmin@VBR12 postgres
The username value must be enclosed in double quotes if it contains a special character (e.g., an underscore) or a space, as seen with the default "SYSTEM@NT AUTHORITY" entry.
The separator between items on a row can be any white space (e.g., one space, three spaces, one tab).
- Save the file. The changes to pg_ident.conf will be taken into account as soon as the file saved.
- Reattempt the initial failed action.
If this KB article did not resolve your issue or you need further assistance with Veeam software, please create a Veeam Support Case.
To submit feedback regarding this article, please click this link: Send Article Feedback
To report a typo on this page, highlight the typo with your mouse and press CTRL + Enter.
